| 1: | What are the two key features that secure the Mobile IP registration messages? |
| A1: | Answer: Replay protection and authentication extensions secure the Mobile IP registration messages. |
| 2: | What prevents a rogue node from setting up the mobility binding for the Mobile Node on the Home Agent? All Mobile IP control packets traverse the home AAA server, where the packet is authenticated. The Home Agent discards any Mobile IP control packet if the IP source address does not equal that of the Mobile Node's home address. The Mobile Node and Home Agent share a security association, and all Mobile IP control packets must be authenticated between the Mobile Node and Home Agent. The FA performs egress filtering and drops any Mobile IP control packets that do not emanate from the Mobile Node's CoA.
|
| A2: | Answer: c. The communication between the Mobile Node and Home Agent must be secure! The Mobile Node and Home Agent must share a security association, and all Mobile IP control packets must be authenticated. |
| 3: | List the different types of Mobile IP authentication extensions, and describe their purpose. |
| A3: | Answer: Mobile NodeHome Agent Authentication Extension (MHAE) Provides secure messaging between the Home Agent and Mobile Node. It is mandatory. Foreign AgentHome Agent Authentication Extension (FHAE) Provides secure messaging between the Foreign Agent and Home Agent. It is optional. Mobile NodeForeign Agent Authentication Extension (MFAE) Provides secure messaging between the Mobile Node and Foreign Agent. It is optional. Mobile NodeAAA Authentication Extension Provides secure messaging between the Mobile Node and AAA server. It is optional.
|
| 4: | Describe how the MHAE and FHAE can secure the same RRQ. |
| A4: | Answer: A Mobile Node secures its RRQ with an MHAE and forwards the request to its Foreign Agent. The Foreign Agent can append an extension to the RRQ and secure the extension with an FHAE. The two extensions secure different parts of the message and are between different Mobile IP entity pairs, namely, the base RRQ is secured between the Mobile Node and Home Agent, and the appended extension is secured between the Foreign Agent and Home Agent. |
| 5: | What elements comprise a security context? How is a security context identified? |
| A5: | Answer: A security context is comprised of an algorithm and mode, a key, and a replay protection method. A specific security context is identified in the authentication extension by the security parameter index, or SPI, value. |
| 6: | What is the standard hash algorithm that must be supported in a Mobile IPv4 deployment? |
| A6: | Answer: HMAC-MD5 must be supported in a Mobile IPv4 deployment. HMAC is a method of computing a hash of a hash of the message and is cryptographically stronger. |
| 7: | To verify the integrity of a message that has an authentication extension appended, the recipient does which of the following? The recipient compares the authenticator value in the appended extension to that stored in the security association for the sender. The recipient computes a cryptographic hash on the authenticator value and compares it to the value stored in the security context. The recipient indexes the security association with the SPI and finds the authenticator value to compare to the value in the extension. The recipient computes a cryptographic hash of the message and compares it to the authenticator value in the appended extension.
|
| A7: | Answer: d. The recipient uses the SPI in the authenticator to identify the security association being used and then uses that security association to compute its own cryptographic hash, which it compares with that contained in the authenticator. If the computed value matches the authenticator value in the message, the recipient knows that the message is as the sender intended. However, if the values do not match, the recipient can deduce that the message has been tampered with in transit. |
| 8: | Replay protection in registration messages is needed for which of the following reasons? To thwart off reflection and replay attacks, where the message is retransmitted at a later time To ensure that data flow is not disrupted and traffic is not redirected by the attacker To guarantee that a unique field exists in the registration messages A and B only A and C only A, B, and C
|
| A8: | Answer: f. |
| 9: | Briefly describe the timestamp replay protection method. |
| A9: | Answer: The Mobile Node sends its timestamp in the identification field of a RRQ. When the Home Agent receives the registration, it verifies the timestamp to ensure that the time in the identification field is within a configured interval of its current timestamp. If the Home Agent finds that the difference between the timestamp and the current time is greater than the allowed interval, it rejects the registration. The Home Agent also updates the first 32 bits with the current timestamp in the RRP. Upon receipt of the RRP, the Mobile Node matches the sent RRQ message to the received reply by comparing the lower 32 bits and then updating its time by computing an offset. The Mobile Node then attempts to reregister with this updated timestamp. |
| 10: | Briefly describe the nonces replay protection method. |
| A10: | Answer: Nonces are a concept in which the identification field is split into two 32-bit values, where the lower-order values are allocated by the Mobile Node and the high-order values are allocated by the Home Agent. For every RRQ, the Mobile Node generates a new lower-order value. The Home Agent copies that value into the lower-order portion of the identification field in the reply and generates a new random value for the high-order portion. The values generated by the Home Agent are then saved and used as the high-order portion of the identification field in the next RRQ sent by the Mobile Node. Because the Home Agent always knows what the next high-order portion of the identification field is supposed to be, it can easily determine whether a message is being replayed. |
| 11: | How does the Mobile Node secure registration messages using the FA Challenge mechanism? The Mobile Node appends a valid challenge value to a registration message that it learns from the FA's advertisements. The Mobile Node appends a valid challenge value that it learns from its Home Agent in a reply message secured with the MHAE. The Mobile Node appends a valid challenge value from a pool of challenge values with which it is preconfigured. The Mobile Node appends a valid challenge value that it learns from the FA through link-layer signaling.
|
| A11: | Answer: a. The Foreign Agent advertises challenge values in its agent advertisements. It maintains a pool of challenge values that are time sensitive. When a Mobile Node sends a RRQ, it must be secured with a valid challenge value. |
| 12: | What is the challenge window? |
| A12: | Answer: The Foreign Agent often offers multiple challenge values that are valid for a specified amount of time, known as the challenge window. |
| 13: | The MN-AAA Authentication Extension can secure RRQs and registration replies. True False
|
| A13: | Answer: False. Because the AAA server does not sit in the registration path, this extension must only be generated by the Mobile Node. Thus, it can authenticate RRQs, but it cannot be used in the RRP because the reply is generated by an HAor perhaps even an FA, which has no access to the AAA server. |
| 14: | Why is the session index extension used in Cisco dynamic security association and key distribution? |
| A14: | Answer: The session identifier differentiates among multiple devices being used by the same user. |
